IAC Devops Engineer

Engagement: Build and maintain Development, Stage, and Production for a set of AI solutions

Role summary

The engineer takes full ownership of the AWS infrastructure powering these AI solutions. Built using Terraform and Terragrunt, the platform demands deep hands-on expertise and practical knowledge.

Responsibilities span the full stack—including edge routing, identity and access, networking, storage, asynchronous workflows, and integrated AI/search services. The engineer will maintain shared, reusable modules across all solutions and manage seamless environment promotion across development, staging, and production environments.

Key responsibilities

●Design, write, and maintain Terraform modules and Terragrunt configuration that can be orchestrated across multiple AWS accounts.

●Build and operate Development, Stage, and Production from that code.

●Own the shared platform: API Gateway, CloudFront, WAF, DNS, certificates, IAM, KMS, VPC and endpoints, Lambda, container services, Step Functions, queues, storage, event rules, and the generative-AI and search services in use.

●Keep infrastructure in code. Return any console change to the repository, and keep remote state out of source control.

●Review a Terraform plan before every apply, including what will change, where, and how it will be rolled back.

●Build the pipelines that validate, scan, test, and deploy. A failed check blocks the merge.

●Apply least-privilege IAM and remove unused roles, broad grants, and placeholder policies.

●Keep infrastructure and container security scans in the pipeline, with an enforced quality gate.

●Support application teams on runtime wiring: function and task configuration, environment variables, secrets, and the image produced by the pipeline.

●Maintain the environments after release, including alarms, retention, certificate renewal, and drift.

●Version Control & Branching Strategy: Experience managing Terraform code in Git using trunk-based development or feature branch workflows, ensuring all infrastructure changes are tracked and peer-reviewed.

●GitHub Actions & CI/CD Integration: Hands-on experience building and maintaining GitHub Actions workflows that automatically run terraform fmt, terraform validate, security scans, and terraform plan on every Pull Request.

●Pull Request Plan Reviews: Automatically posting terraform plan output as a comment on GitHub Pull Requests to facilitate asynchronous code and infrastructure reviews before merging.

●Branch Protection & Quality Gates: Enforcing strict branch protection rules in GitHub where passing automated checks (linting, security, and clean plan) and requiring at least one peer review are mandatory pre-requisites to merge into main.

●Module Versioning & Releases: Utilizing Git tagging and semantic versioning for shared Terraform modules stored in private registries or repositories to ensure reproducible and controlled module consumption across environments.

Required qualifications

●HashiCorp Certified: Terraform Associate (003) certification.

●Hands-on Terraform for production AWS, including modules, remote state per environment, and plan-before-apply.

●Hands-on Terragrunt across more than one AWS account.

●Practical experience building IAM, networking, Lambda, container services, API Gateway, CloudFront, WAF, DNS, certificates, and KMS.

●A deployment pipeline the candidate has written and operated, with validation and deployment and without a manual apply.

●Experience turning an existing Terraform codebase into modules that several solutions can share.

●Ability to explain a Terraform plan line by line and to show the evidence that a change worked.

●Granular Terraform state management practices, including remote state backends, state locking, targeted isolation, and state recovery/imports.

●Proficiency in defining and enforcing Terraform best practices, module design, semantic versioning, and standardized directory structuring.

●Hands-on experience integrating IaC linting, automated testing, and security scanning tools (e.g., TFLint, Checkov, Trivy, or SonarQube) into CI/CD pipelines.

●Experience writing and executing unit and integration tests for Terraform code using frameworks such as Terratest or native Terraform test feature.

Preferred qualifications

●Advanced HashiCorp certifications, such as HashiCorp Certified: Vault Associate/Operations Professional.

●Amazon Bedrock, or another managed generative-AI service, and a vector search service.

●Step Functions, queues, and event-driven processing.

●Container build and registry, with images pinned by digest or immutable tag.

●Infrastructure and container scanners tied to a failing quality gate.

●OAuth or enterprise identity integrated with an API.

●Experience improving inherited infrastructure rather than only starting from an empty account.

Ways of working

●A second person reviews the plan and the change. The reviewer is not the author.

●Model-assisted code is a draft until the author can explain it and a reviewer has approved it.

●A change is complete when the pull request, the review, and the plan or deployment output are all attached.

• Opportunity to work on real-world projects with leading clients
  

• Learning-focused environment with mentorship from senior engineers
  

• Stable, long-term career growth opportunities